CWE-79

CVE-2018-11709

February 26, 2023 by

wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting (XSS) via the URI.

CVE-2018-11647

February 26, 2023 by

index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL.

CVE-2018-11649

February 26, 2023 by

Hue 3.12 has XSS via the /pig/save/ name and script parameters.

CVE-2018-11650

February 26, 2023 by

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.

Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx.

CVE-2018-11583

February 26, 2023 by

SeaCMS 6.61 has stored XSS in admin_collect.php via the siteurl parameter.